A reference of terms you will encounter in the SendOps dashboard, this documentation, and the AWS SES ecosystem.

---

**Activity** — a free-form behavioral signal your integration pushes about a contact via the Public API: a `name`, optional `properties`, and `occurred_at` timestamp (for example `purchase` or `page_view`). Activities are stored append-only per contact, resolved by email or `external_id` (creating a stub contact if needed), and are usable in [Segment rules](/audience/segment-syntax) and [Workflow triggers](/workflows/triggers) as `activity.<name>` — with properties queryable once [promoted](/audience/activities#promoted-properties). Distinct from SES message events (bounce, open, click — see [Engagement](/reports/engagement-metrics)) and the dashboard [Audit Log](/team/audit-log). See [Activities](/audience/activities).

**Attribute** — a custom field stored on a contact (for example `plan`, `region`, or `signup_date`). Each attribute is defined in the attribute registry with a name and a type (string, number, bool, datetime, or enum), and is referenced in [Segment](/audience/segments) rules as `attr.<name>`. See [Attributes](/audience/attributes).

**AWS Status Badge** — a header indicator in the SendOps dashboard that shows the state of your AWS connection. Possible states: Not Connected, Connecting, Validating, Connection Error, Update Available, Sandbox, and AWS Connected. See [AWS Integration](/aws-setup/connecting-aws).

**Bounce (Hard)** — a permanent delivery failure. The recipient address does not exist, the domain is invalid, or the receiving server has permanently rejected the message. Hard bounces count toward your SES bounce rate and the address should not be retried. SES warning threshold is 5%, critical threshold is 10%. See [Deliverability Problems](/troubleshooting/deliverability-problems).

**Bounce (Soft)** — a temporary delivery failure. The recipient's mailbox may be full, the server may be temporarily unavailable, or the message may be too large. SES retries soft bounces automatically before giving up.

**Channel** — a named configuration in SendOps that maps to an AWS SES configuration set (named `sesmail-<slug>` in your AWS account). Channels have a Purpose (Default, Transactional, Marketing, Onboarding, or Custom) and control how emails are tracked and processed. Each channel has settings for sending enabled/disabled, TLS policy, max delivery duration, auto validation threshold, suppression override, and engagement tracking. Four default channels are provisioned during onboarding: Default, Transactional, Marketing, and Onboarding. See [Understanding Channels](/channels/understanding-channels).

**Channel Sync Status** — indicates whether a channel's configuration in SendOps matches its corresponding SES configuration set. Possible values: synced, syncing, or error. See [Managing Channels](/channels/managing-channels).

**Click Tracking** — a feature that rewrites links in HTML emails to pass through a tracking domain, recording when a recipient clicks a link. Click events appear in the SendOps [Messages Dashboard](/reports/messages-dashboard). Requires a tracking domain to be configured. See [Tracking Domains](/domains/tracking-domains).

**CloudFormation Stack** — the AWS CloudFormation template that provisions the resources SendOps needs in your AWS account. The stack creates: SendOpsRole (IAM role), SendOpsConfigSet (SES configuration set), SendOpsEventDestination, SendOpsConnection, SendOpsApiDestination, SendOpsEventBridgeRole, SendOpsEventRule. See [AWS Integration](/aws-setup/connecting-aws).

**Complaint** — a report generated when a recipient marks your email as spam using their email client's "Report Spam" button. ISPs send complaints back to SES through feedback loops. SES warning threshold is 0.08%, critical threshold is 0.1%. See [Deliverability Problems](/troubleshooting/deliverability-problems).

**Config Set / Configuration Set** — an SES resource that defines event publishing rules. When you send email through a configuration set, SES publishes delivery events to destinations via EventBridge. SES supports 10 event types: Send, Delivery, Bounce, Complaint, Reject, Open, Click, DeliveryDelay, RenderingFailure, and Subscription. In SendOps, each channel maps to a configuration set named `sesmail-<slug>`. See [AWS Integration](/aws-setup/connecting-aws).

**Contact** — a person in your audience: one email address, plus its [attributes](/audience/attributes), its topic subscriptions, and its global unsubscribe state. Contacts are backed by the single **SES contact list** AWS gives an *account* (see below), so SendOps imports what SES already holds and writes new contacts back to it — and two workspaces sharing one AWS account share their contacts. Distinct from a [List](/audience/lists), which is a group you build inside SendOps to target: you browse contacts, you send to Lists and [Segments](/audience/segments). See [Contacts](/audience/contacts).

**Contact List (SES)** — the AWS SES resource that holds your contacts and your [topics](/audience/topics). SES allows exactly **one per AWS account**; SendOps adopts whichever list the account already has, or creates one named `sendops-contacts`. It is the reason contacts and topics are account-wide while [Lists](/audience/lists) are not. Not to be confused with a SendOps **List**. See [Shared AWS accounts](/aws-setup/shared-accounts).

**Connections** — a section in the SendOps dashboard for managing external integrations. It has two tabs: **Webhooks** for configuring HTTP callback endpoints that receive event notifications, and **Integrations** for connecting third-party services like Slack.

**DKIM (DomainKeys Identified Mail)** — an email authentication method that attaches a cryptographic signature to outgoing messages. The receiving server verifies the signature against public keys published as DNS CNAME records, confirming the message was not altered in transit and was sent by an authorized server. In SendOps, successful DKIM verification is what marks a domain as verified. See [DNS Configuration](/domains/dns-configuration).

**DMARC (Domain-based Message Authentication, Reporting, and Conformance)** — a DNS-based policy that tells receiving servers what to do when SPF or DKIM checks fail. DMARC also enables aggregate reporting so you can monitor authentication results. Published as a TXT record at `_dmarc.yourdomain.com`.

**Domain Identity** — a domain that has been verified in AWS SES via DKIM, proving you own it. Once verified (DKIM status is "Success"), you can send email from any address at that domain. Domains can be assigned to a channel and have associated email identities. See [Adding a Domain](/domains/adding-a-domain).

**Email Identity** — a specific sender email address registered in SendOps and associated with a verified domain. Email identities are assigned to a channel and marked as managed, meaning SendOps tracks their usage. See [Email Identities](/domains/email-identities).

**Engagement** — a measure of how recipients interact with your emails. In SendOps, engagement is tracked through open and click events, with performance broken down by template. See [Engagement Metrics](/reports/engagement-metrics).

**Event Destination** — the mechanism that delivers SES email events from your AWS account to SendOps. SendOps uses an auto-configured EventBridge rule with an API Destination (authenticated via x-api-key, rate-limited to 300 invocations per second). See [AWS Integration](/aws-setup/connecting-aws).

**EventBridge** — an AWS service that routes events between AWS services and external targets. SendOps uses EventBridge to receive real-time SES email events (all 10 event types: Send, Delivery, Bounce, Complaint, Reject, Open, Click, DeliveryDelay, RenderingFailure, Subscription) from your AWS account via an API Destination.

**External ID** — a unique identifier included in STS AssumeRole requests to prevent confused deputy attacks. Each SendOps organization has its own External ID, which must be set as a condition in your IAM role's trust policy. See [AWS Integration](/aws-setup/connecting-aws).

**IAM Role** — an AWS Identity and Access Management entity with specific permissions that can be assumed by trusted parties. SendOps uses a cross-account IAM role to access your SES resources without requiring static API keys. The role is created by the CloudFormation stack during onboarding.

**Identity** — a general term for a verified sender in SES, which can be either a domain identity or an email identity.

**List** — a static audience with explicit membership: a set of contacts that stays fixed until you change it. A List exists **only in SendOps** — it has no AWS representation — and is created in the dashboard, over the API, or as code in a connected repository. Lists and [Segments](/audience/segments) are what you send to. Distinct from the [Segment](/audience/segments) (rule-based), from your [Contacts](/audience/contacts) (the whole population, owned by your AWS account), and from the SES [Suppression List](/reports/undeliverable-list) (a deliverability safeguard). See [Lists](/audience/lists).

**Managed Identity** — a domain or email identity that is tracked by SendOps. When events are ingested, SendOps filters by managed identities to associate events with the correct organization. Only events from managed identities are processed and displayed in the dashboard.

**Open Tracking** — a feature that inserts a tiny invisible image (tracking pixel) into HTML emails. When the recipient's email client loads the image, an open event is recorded. Open tracking requires HTML email and is not 100% reliable due to image blocking by some clients.

**Ownership Transfer** — the process of transferring the Owner role from one team member to another. The current Owner initiates the transfer from Workspace Settings, and the target member has 72 hours to accept via email link or dashboard banner. On acceptance, the former Owner becomes an Org Admin. All transfer actions are recorded in the [audit log](/team/audit-log). See [Transferring ownership](/team/members-and-roles#transferring-ownership).

**Predicate** — the rule that defines a [Segment](/audience/segments): an expression that is true or false for each contact, built from the contact's [attributes](/audience/attributes) (`attr.<name>`) and built-in engagement and subscription state, written in SendQL. A predicate that no longer compiles makes its Segment **Invalid**. See [Segments](/audience/segments#how-the-rule-works).

**Roles** — SendOps supports eight organization roles that control access and permissions: **Owner** (full control including billing, ownership transfer, and account deletion), **Org Admin** (manages members, billing, and org settings but cannot transfer ownership or delete the org), **Infra Admin** (manages AWS connections, domains, tracking domains, and infrastructure configuration), **Developer** (manages templates, GitHub connections, channels, and the audience and automation layer), **Marketer** (manages the audience and automation layer — contacts, lists, segments, workflows, broadcasts — plus suppression lists, and views analytics and reports), **Financial** (invoices, payment methods, billing settings, and SES cost estimates), **Customer Support** (searches deliveries by recipient, manages suppression lists, and views the audience layer for triage), and **Viewer** (read-only access to dashboards, templates, and analytics). See [Team Members & Roles](/team/members-and-roles).

**Segment** — a dynamic audience defined by a rule (its *predicate*) rather than explicit membership. SendOps evaluates the rule against each contact's [attributes](/audience/attributes) and engagement and keeps membership current automatically. A Segment has a status (Active, Paused, Invalid, or Archived) and an evaluation mode (Incremental, Sweep, or both). Distinct from the static [List](/audience/lists). See [Segments](/audience/segments).

**SES Sandbox** — the default state for new SES accounts. In sandbox mode, you can only send to verified email addresses and have reduced sending limits. You must request production access from AWS to send to arbitrary recipients. The AWS Status Badge shows "Sandbox" when your account is in sandbox mode. See [SES Sandbox & Production](/sending-email/ses-sandbox).

**Setup Guide** — the four-phase onboarding process in SendOps that walks you through connecting your AWS account. The phases are: AWS Integration, Connection Validation, Domain Verification, and First Test Send. See [Creating Your Account](/getting-started/creating-your-account).

**SPF (Sender Policy Framework)** — a DNS-based authentication method that specifies which mail servers are authorized to send email on behalf of a domain. Published as a TXT record. For SES, the record should include `include:amazonses.com`.

**STS (Security Token Service)** — an AWS service that issues temporary, limited-privilege credentials. SendOps uses STS AssumeRole to obtain short-lived credentials for accessing your AWS resources.

**Suppression List** — an account-level list maintained by SES that prevents sending to email addresses that have previously hard bounced or complained. The suppression list reduces future bounces and protects your sender reputation. Channels can override suppression behavior via the suppression override setting.

**Topic** — a named stream of mail a recipient can opt out of on its own ("Product updates," "Weekly digest"), which is what makes an unsubscribe **granular** rather than all-or-nothing. Topics are the choices shown on the [unsubscribe page](/sending-email/unsubscribe-page); a recipient can leave a Topic but can never leave a [List](/audience/lists), because a List is targeting rather than consent. Topics live on the same account-wide **SES contact list** as your [Contacts](/audience/contacts). See [Topics](/audience/topics).

**Template** — a reusable email layout with placeholders for dynamic content. In SendOps, templates are managed through GitHub integration — connect a repository and SendOps syncs your templates automatically. Templates are deployed to SES as SES templates. See [Template Management](/templates/template-management).

**Tracking Domain** — a custom subdomain (e.g., `track.example.com`) used for open and click tracking instead of the default SES tracking domain. Tracking domains require DNS verification (CNAME) and SES identity verification (DKIM). Using your own tracking domain improves deliverability by keeping all URLs on-brand. See [Tracking Domains](/domains/tracking-domains).

**Webhook** — an HTTP callback endpoint that sends real-time notification data to an external URL when specific events occur. Webhooks are configured under the **Webhooks** tab in the **Connections** section of the SendOps dashboard. Each webhook has a signing secret for payload verification. See [Webhooks](/notifications/webhooks).